Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-30001 · ADVISORY
• apache/streampark · PACKAGE
• lists.apache.org/thread/xfmsvhkcnr1831n0w5ovy3p44lsmfb7m · WEB
• openwall.com/lists/oss-security/2025/09/04/1 · WEB

org.apache.streampark:streampark 的其他漏洞

• CVE-2025-53960中危 5.9When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algori…
• CVE-2025-54981高危 7.5Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive da…
• CVE-2025-54947严重 9.8In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability…
• CVE-2024-29178高危 8.8On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The …
• CVE-2024-29120中危 5.9In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authe…